Threats affecting pkg:github/ggml-org/whisper.cpp

CVE-2026-110810 is a low-severity vulnerability in ggml-org whisper.cpp up to version 1.9.4. It involves an out-of-bounds read in the whisper_model_load function triggered by manipulating the argument ttype. The vulnerability requires local access and low privileges to exploit. A public exploit exists. Upgrading to version 1.9.5 mitigates the issue.

A security flaw has been discovered in ggml-org whisper.cpp up to 1.8.2. This vulnerability affects the function whisper_model_load of the file ggml/src/ggml.c. The manipulation results in null pointer dereference. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2025-14569 is a use-after-free vulnerability in the read_audio_data function of whisper.cpp versions up to 1.8.2, part of the ggml-org project. The flaw allows local attackers with limited privileges to exploit memory corruption, potentially leading to data corruption or application crashes. No user interaction is required, but local access and low privileges are necessary. The vulnerability has a medium severity score of 4.8 and currently no known exploits in the wild. The vendor has not yet responded to the issue. European organizations using whisper.